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ON EXPONENTIAL POLYNOMIALS AND QUANTUM COMPUTING 



YASUO OHNO*, YOSHITAKA SASAKI^, AND CHIKA YAMAZAKit 



Abstract. We calculate the zeros of an exponential polynomial of three variables by 



o. 

, a classical algorithm and quantum algorithms which are based on the method of van 

Dam and Shparlinski, they treated the case of two variables, and compare with the time 
^■P' complexity of those cases. Further we compare the case of van Dam and Shparlinski 

with our case by considering the ratio (classical/quantum) of the time complexity. Then 
we can observe the ratio decreases. 



< 



1. Introduction 



For a prime number p, we put q = , where z/ is a certain positive integer. Then we 
^ ! denote the finite field by ¥q which has q — 1 elements. Namely, forms an additive 
^! group and := Fq\{0} forms a multiplicative group, where is the zero element in Fg. 

Any element of a G F^ have a periodicity, that is there exits a smallest natural number 
s such that a* = 1. We call such s the "multiplicative order" of a. It is known that the 
■ multiplicative order is a divisor of #F^ = q — 1. 
^ ' To calculate the number of the zeros of a polynomial 

oo ■ ^ — ^ 

^ ■ {ni,...,nm)(^Nl^ 

^ I is a very important problem in mathematics. Here, Nq := N U {0} and an^^,,,^nm ^ ^q- 
[3], van Dam and Shparlinski treated the following exponential polynomial 

X; (1.1) f{x,y) = aigl + a2gl-b 

c5 

and calculated the zeros of (1-1) by quantum algorithms. Further they compared the time 
complexity due to a classical algorithm with that due to a quantum algorithm. Then the 
"cubic" speed-up was observed. 
In this article, we treat the following exponential polynomial 

(1.2) fb{xi, X2, X3) := aig^^ + 025-2" + "sS's' " b 

and calculate the solutions of fb{xi,X2,xs) = by using quantum algorithms which are 
natural generalizations of the method of van Dam and Shparlinski. Here, a^, gj G F^ 
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— 1, 2, 3) and 6 e Fg. Further we also compare the time complexity due to a classical 
algorithm with that due to a quantum algorithm. Then exponentially "5/2 times" speed- 
up is observed. 

In the next section, we introduce some notation and give the considerable lemma which 
supports whether there exit the zeros of (1.2). In Section 3, we evaluate the time com- 
plexity due to a classical algorithm. Further in Section 4, we evaluate the time complexity 
due to a quantum algorithm. 

2. The number of solutions of equation 
In this section, we give an important formula with respect to the density of solutions 

of 

(2.1) fb{xi,X2, xs) := aig^' + aa^s' + ^-sST - b^O 

as Lemma 2.1, below. To state it, we introduce some notation. 

Let each Sj be the multiplicative order of gi {i = 1, 2, 3) in (2.1). We put 

Xi := {0, 1, . . . , - 1} ^ Z/siZ, (i = 1, 2, 3), 
X3(r) := {0, 1, . . . , r - 1} C (r = 1, 2, . . . , S3), 
X'\r) := X1XX2X Xsir) 

and 

:= X^iss) = X X X3. 

Then we define 

Sfbir) ■■= {{xi,X2,Xs) e X^{r) I fb{xi,X2,X3) = 0}, 

for r = 1, . . . ,53. 

By using above notation, we can state the following result: 

Lemma 2.1. Let S be a parameter satisfying S = o{q). For r > S^q^{siS2)~'^ , we have 

(2.2) Nf,{r)^'-^ + 0{5^), 

except for at most q/S^ exceptional b's. Further O -constant can he taken 1. 
Choosing 5 — (logg)^/^ in Lemma 2.1, we have 

Corollary 2.2. If q^{s 182)''^ log q < r < S3, then we see that Sf^^{r) ^ 4> holds except 
for at most q/ logq exceptional b 's. 
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Remcirk 2.3. The above lemma and corollary make the point that the solutions of 
(2.1) exit only when 



^l^^^S^J ^^^^ 



This inequality implies that the multiplicative orders Si and S2 are somewhat large. 

Remcirk 2.4. The exponent 1/2 of 5 = (logg)^/^ is not necessary. In fact, 5 — (logg')^ 
with any £ > is sufficient. 

Proof of Lemma 2.1. Let ^ be a non-trivial additive character over Fg, in fact, any 
additive character over Fg can be given as a map Fg — > C^, where C* := {z e C||2;| = 1} 
(see [5, Theorem 5.7]). To evaluate Nf^{v), we use the following formula which plays as 
a counting function: 



^S/'-'Ho ..... 



Then we have 



(2.4) Nf,{r)^ Yl ^$^^(M/6(^i,^2,X3))) 



Q 

SiS2r 1 



h Ab(r). 



If the contribution from the second term on the right-hand side of the above formula 
can be estimated by o(siS2r/g), the above formula tells us the existence of the solution 
of a;2, 2:3). To consider it, wc evaluate the mean value of the second term on the 

right-hand side of (2.4) with respect to h. Namely, we evaluate 



E{r) :=5]|A,(r)r. 
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Prom (2.3) and some properties of the additive character over F^, we obtain 



J2 ^Mi^gr-i^'gf)) 



beFg 



=^ E ( n ( E ^(%/^(^^ - ^?)) ) ) E "^Mar - gf)) 

IJ.e¥^ \i=l \xj,x'.eXj J J X3,x'3&X3{r) 



n 



Q 

It is known that 



E ^i^ji^g?) 



< ^/q for j = 1, 2 and any G 



(see Theorem 8.78 in [5]). Hence we have 



AieFg 0:36X3 (r) 

Therefore, if we put 5 = o{q), then we can see that there exit at most q/5^ exceptional 
6's such that 



(2.5) 

Hence we obtain 



-E E '^Wb{xi,X2,X3))) 



fj-eV* {xi,X2,X3)eX3{r) 



> 5^/rq. 



for other 6's. Now, the proof of Lemma 2.1 is completed. □ 

3. Calculation of the deterministic time for a classical algorithm 

We follow the method of van Dam and Shparlinski [3] . Then we have 

Theorem 3.1. Except for at most q/ logq exceptional b's, we can either find a solution 
{xi,X2,X3) G of the equation (2.1) or decide that it does not have a solution in 
deterministic time g^/^(logg)'^*^^^ as a classical computer. 

Proof. Using a standard deterministic factorization algorithm, we factorize q — 1 and 
find the orders Sj (j = 1,2,3) of gj in time g^/^(log g)'^*^^\ We may assume without loss 
of generality that Si > S2 > S3. Por calculated orders Si and S2, we put 

(3.1) r^\q'{s,S2)-nogq]. 
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Then we see that the solution of (2.1) certainly exists when r < S3. However, when 
r > S3, we do not know whether such solutions exits. Therefore we have to consider those 
two cases. 

For each {x2,X3) E X2 x Xs{r), we calculate the deterministic time of the discrete 
logarithm xi such that g^^ = a^^{b — 02^72^ ~ (^sqT)- known that the deterministic 
time for this case is s\^^{logq)'^^^^ (see Section 5.3 in [2]). 

(i) The case r < S3. We have 

(^2r)sf(logg)^««g^/^(log?)°W, 

since sJ^^S2^ < {sfs'^ry^'^. 

(ii) The case r > S3. Similarly, we see that the deterministic time is 

(s2S3)s}/^(logg)^W«g3/^(logg)^W, 
since s}''^S2S3 < (sis|s3)^/^ < (sfs2r)^/^. 

□ 

4. Calculation of the time complexity for a quantum algorithm 

In this section, we describe quantum algorithms which are based on the method of [3] . 

Theorem 4.1. Except for at most q/ logg exceptional h's, we can either find a solution 
(xi, ,X2, X3) G of the equation (2.1) or decide that it does not have a solution in time 
g3/5QQg ^^o(i) g,^^ quantum computer. 

Proof. Using Shor's algorithm [6], we can obtain the multiplicative orders sfs (j = 
1, 2, 3) in polynomial time. We may assume without loss of generality that Si > S2 > S3. 
As in the proof of Theorem 3.1, we put r as (3.1). Further, we consider a polynomial time 
quantum subroutine S{x2iXz) which either finds and returns xi e Xi with 

or reports that no such xi exists for a given (2:2, x^) e X2 x X^{r) by using Shor's discrete 
logarithm algorithm. 

(i) The case r < S3. Using Grover's search algorithm [4], we search the subroutine 
S{x2, x^ for all (x2, x^) e X2 x X^{r) in time 

(a;2r)i/2QQg^)0(i) ^ q^/^ilogqfi^) ^ 

since X2r < (s^s^r)^/^. 

(ii) The case r > S3. Similarly, we search the S{x2iXz) for all (a;2,a;3) e X2 x X3 in 
time 

{x2X^f'\\ogqf^^^ < q^'\\ogqf^^\ 
since X2X3 < (siS2S3)^/^ < (s^s^r)^/^. 
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□ 

In [3], van Dam and Shparlinski mentioned when the multiphcative orders are large, 
there is a more efficient quantum algorithm. Similarly, we can also consider a more 
efficient quantum algorithm. 

Theorem 4.2. If we assume 

(siS2)^S3 > q^logq, 

then we can either find a solution {xi,X2,X3) e of the equation (2.1) or decide that it 
does not have a solution in time q^ {s^s 283)'^^^^ {log q)^^^^ as a quantum computer, except 
for at most q/ logq exceptional b 's. 

Remark 4.3. The upper bound of the running time of the algorithm of Theorem 4.2 

is 

0(gi/5(logg)^«). 

Proof of Theorem 4.2. We may assume without loss of generahty that si > S2 > 
S3. We put 

(4.1) r= L?'(«i«2)-'loggJ 

Then from the assumption of the theorem we see that r < S3. Hence there are some 
solutions of (2.1) in X^{r) and we denote the number of the solutions of (2.1) by M. 
Note that M x {siS2r)/q. 

As in the case of [3], we use the version of Grover's algorithm as described in [1] that 
finds one out of m matching items in a set of size t by using only 0{\/t/m) queries. We 
search the subroutine S{x2, x^) for all (a;2, ^3) e X2 x -^3(r). Then the time complexity is 




□ 

5. Concluding remarks 

At the end of this article, we compare the case of van Dam and Shparlinski with our 
case. See the following hst. 



# of variables 


Classical 


Quantum 


ratio (C/Q) 


2 


1 


1/3 


3 


3 


3/2 


3/5 


5/2 



The case of two variables is that of van Dam and Shparlinski and the case of three variables 
is our case. We notice that the ratio decreases. Does the ratio decrease to 1 when the 
dimension increase? We can apply the method used in [3] and this paper to the case of 
any variables. By roughly calculating, the ratio seems to converge 2, when the number of 
the variables increases. It seems to come from the effect of Grover's algorithm. 
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